OWASP Top 10 API Security Risks

OWASP Top 10 API Security Risks

• 1.
  top10 APISecurityRisks OWASP
• 2.
  APIs without authen�ca�on api/userID/20905 api/userID/20804 BOB John This iswhen API returns sensi�ve data to a user who doesn’t have permission to access that data 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 API1:2019 Broken Object-Level Authorization
• 3.
  This is whenAPI returns sensi�ve data to a user who doesn’t have permission to access that data A�acker API Endpoints <> <> <> <> <> <> <> <> Uses creden�al stuffing with stolen password database API2:2019 Broken User Authentication
• 4.
  This is whenAPI is designed to expose all sensi�ve data without proper filtering Sam GET /api/userprofile Applica�on Server Database Server { [Name: Sam.. Card No.: 1234 SSN: 709-99-789, Name: John.. Card No.: 5467 SSN: 237-71-567, ...] } 709-99-7890 Sam 1234 5678 9012 3456 DOB 709-99-7890 API3:2019 Excessive Data Exposure
• 5.
  When there isno restric�on on the number of requests made by users, APIs can be vulnerable to brute force and DDoS a�acks ! API4:2019 Lack of Resources & Rate Limiting
• 6.
  GET/accounts/emp1/account_detail GET/accounts/emp2/account_detail Alex A�acker What if ireplace emp1 with emp2 and view someone else’s data This is when an API allows users to use HTTP methods to execute func�ons, they are unauthorized to perform API5:2019 Broken Function Level Authorization
• 7.
  Trust us for WebApplica�on and API Protec�on Start your free trial at indusface.com/api
• 8.
  POST/order/coupon ... {”coupon_code”: {”welcome10”, ”welcome10”, ”welcome10”, ...] } 200 OK ... {”Order_value”:”0$”} A�ack Scenario E-Commercesite Normal Scenario POST/order/coupon ... {”coupon_code”:”welcome10”} 200 OK ... {”order_value”:”90$”} E-Commerce site It occurs when an API takes user input directly and maps the values to the backend object models without proper filtering API6:2019 Mass Assignment
• 9.
  An API componentis suscep�ble to a�ack due to a nonsecure configura�on op�on Unhardened Images HTTP headers HTTP CORS Open files and folders Verbose errors API7:2019 Security Misconfiguration
• 10.
  A�ackers send maliciousdata to an API that passes it into the database User A�acker Server Select * from users WHERE userID =’1199’ and password = ‘secretpw’; Select * from users WHERE userID =’1199’ and password = “or 1=1; User ID : Password : API8:2019 Injection
• 11.
  A�ackers may breakinto the current API by exploi�ng the vulnerability on the staging API if le� unmanaged Beta API Produc�on API API9:2019 Improper Assets Management
• 12.
  It occurs whenthere are no recording details about auditable events inside an API Properly Set Up Logging New Threat Detected! Insufficient Logging All Good! ATTACK IN PROGRESS My User Name LOG IN Forgot Password API10:2019 Insufficient Logging & Monitoring
• 13.
  Scan & ProtectYour APIs Today! API Discovery API Vulnerability Scanning DDoS & Bot Mi�ga�on API Pen Tes�ng Start your free trial at indusface.com/api OWASP Top 10 Protec�on